A document was uploaded to a deal

POST

To both parties, with the document’s id and category only. List and download with documents:read. Every delivery is a POST with a JSON body and four headers: Quatlas-Event-Id (the event’s id; dedupe on it, a delivery can arrive more than once), Quatlas-Event-Type, Quatlas-Timestamp (Unix seconds) and Quatlas-Signature: v1=, the lowercase hex HMAC-SHA256 of “.” keyed with your subscription’s signing secret (whsec_…). During a secret rotation the header carries one v1= value per valid secret, comma-separated; accept the delivery when any one matches. Compute the HMAC over the raw bytes you received, compare in constant time, and refuse a timestamp more than 5 minutes from your clock (replay). Answer any 2xx within 10 seconds to acknowledge; anything else, a redirect included, is retried after 1 minute, 5, 30, 2 hours, 6 and 12. After 20 failures in a row the subscription is switched off. Bodies are thin on purpose: fetch the details through the read API with your key’s scopes.

Parameters

Header Parameters

Quatlas-Event-Id

required

string

The event’s id (uuid). The same event delivered twice carries the same id: dedupe on it.

Quatlas-Event-Type

required

string

The event’s type: document.uploaded.

Quatlas-Timestamp

required

string

When this delivery was signed, in Unix seconds. Refuse one more than 5 minutes from your clock.

Quatlas-Signature

required

string

V1=<hex HMAC-SHA256(secret, “.”)>, one value per valid secret, comma-separated.

Request Body^required

Media typeapplication/json

The body of a document.uploaded delivery.

object

data

required

The identifying fields, and the facts this type carries.

object

category

required

The document’s category (CommercialInvoice, PackingList, BillOfLading, …).

string

dealId

required

The deal the event is about, when there is one.

null | string format: uuid

dealNumber

required

The deal’s business number (DEAL-206447), once there is a deal.

null | string

documentId

required

The document’s id.

string format: uuid

externalReference

required

Your own reference for the request, only when your company owns it.

null | string

metadata

Your metadata on the request: only in a delivery to your company when it owns the request and has set some. Absent otherwise; never sent to another company.

object

key

additional properties

string

quoteNumber

required

The quote’s business number (QTE-731905): the winning quote once a deal exists, or the offer that arrived on request.bid_received.

null | string

requestNumber

required

The request’s business number (REQ-048213), when there is a request.

null | string

shipmentNumber

required

The operation’s business number (SHPT-012618), once the deal went live.

null | string

shipmentRequestId

required

The request the event is about, when there is one.

null | string format: uuid

id

required

The event’s id, also in Quatlas-Event-Id.

string format: uuid

livemode

required

False for a sandbox (test integration) event and for webhook.test.

boolean

occurredAt

required

When the fact became true (UTC).

string format: date-time

type

required

The event’s type.

string

Allowed value: document.uploaded

Responses

2XX

Any 2xx within 10 seconds acknowledges the delivery.